Tag Archives: TLS

Last year a really good project Letsencrypt came up. They key objective of this project is to help in securing web by pushing SSL everywhere.

Two key cool features

It offer free signed SSL certs!

It helps in setting up SSL via an agent seamlessly without having to deal with CSR, getting it signed & updating web server configuration.

At this stage Letsencrypt is itself a Certificate Authority and but it’s root certs are yet not in the browser. It’s probably going to take a while till all major browsers get their certificate.

To help on that one of it’s sponsors IdenTrust has signed their intermediate certs. Hence certs signed by Letsencrypt are accepted by all browsers right away. All certs signed by Letsencypt are signed by Letencrypt Authority X1 which have signature from DST Root CA X3 which is accepted by pretty much all popular browsers. You can read more about How it works here.

Here’s an example of SSL setup for say “demo.anuragbhatia.com” test domain which is already up and working without SSL. http://demo.anuragbhatia.com shows a plain text page. This is Apache running on Ubuntu server.

The Apache web config is pretty straightforward.

1

2

3

4

5

6

<VirtualHost *:80>

ServerName demo.anuragbhatia.com

DocumentRoot /var/www/demo.anuragbhatia.com

ErrorLog /var/log/apache2/demo.anuragbhatia.com

LogLevel notice

</VirtualHost>

Step 1 – Grab the Letscrypt agent

git clone https://github.com/letsencrypt/letsencrypt

Step 2 – Execute the auto script

./letsencrypt-auto –help

This will grab all needed dependencies and will get the agent working.

Step 3 – Execute Letsencrypt auto script with it’s Apache plugin

./letsencrypt-auto –apache -d demo.anuragbhatia.com

It takes with a quick wizard and in the end I get:

Congratulations! You have successfully enabled https://demo.anuragbhatia.com